blogs

Publication: 08/07/2024

‍

Introducing the Web3 Security Coalition

‍

GET IN TOUCH

‍

“I won’t attack there, it’s not in scope” -  said no attacker ever.

‍

The Web3 Security Coalition is beginning as a strategic partnership between FYEO and Trugard to offer to users, investors, and researchers in Web3 a comprehensive threat intelligence platform that combines insights from both blockchain-based smart contracts and traditional web domains. The thesis is simple: phishing contracts powering phishing domains == assets stolen, so it’s time for truly holistic security.

‍

Here's an outline of how Web3 enthusiasts and investors can benefit from such an advanced data offering:

‍

1. Enhanced threat detection:
   1. Correlate risky smart contracts with suspicious domains
   2. Identify patterns between malicious on-chain activities and off-chain phishing attempts
2. Improved asset protection:
   1. Warn users about potentially harmful smart contracts and associated phishing sites
   2. Provide a more holistic view of threats targeting crypto users and investors
3. Fraud prevention:
   1. Track the movement of stolen funds from smart contract exploits to cash-out points
   2. Identify and blacklist domains associated with known malicious smart contracts
4. Regulatory compliance:
   1. Offer a more comprehensive solution for AML (Anti-Money Laundering) and KYC (Know Your Customer) processes
   2. Help crypto businesses comply with evolving regulations by providing a broader spectrum of risk data
5. Research and trends:
   1. Analyze the relationship between smart contract vulnerabilities and phishing campaigns
   2. Provide valuable insights into the evolving tactics of crypto-focused cybercriminals
6. User education:
   1. Develop resources to educate users about the interconnected nature of on-chain and off-chain risks
   2. Create awareness campaigns to promote safe practices in the crypto space

By combining our unique datasets and expertise, FYEO and Trugard offer a powerful joint solution that addresses the complex and interconnected nature of threats in the cryptocurrency ecosystem. This exciting partnership is particularly valuable as the lines between traditional finance, web-based services, and blockchain technologies continue to blur.

‍

The Emergence of Decentralized Business Risk

‍

The connection between a phishing smart contract and a phishing website is an example of how on-chain and off-chain threats can work in tandem. Let's break this down:

‍

1. Smart Contract Setup:
   1. A malicious actor creates a smart contract on an EVM-compatible blockchain (e.g., Ethereum).
   2. This contract is designed to look legitimate but contains hidden functions that allow the attacker to drain funds or manipulate token balances.
2. Phishing Website Creation:
   1. The same actor sets up a website that mimics a popular DeFi platform, NFT marketplace, or crypto exchange.
   2. The website's frontend is designed to look identical to the legitimate site it's impersonating.
3. Integration:
   1. Instead of connecting to the real platform's smart contracts, the phishing site interfaces with the malicious smart contract.
   2. The website might prompt users to "connect their wallet" or "approve" a transaction, which actually interacts with the phishing contract.
4. User Deception:
   1. Victims are lured to the phishing website through various means (e.g., fake ads, social media posts, or typosquatting domains).
   2. Believing they're on a legitimate platform, users interact with the site, unknowingly sending transactions to the malicious smart contract.
5. Exploitation:
   1. When users approve transactions or transfer funds, the phishing contract executes its hidden malicious functions.
   2. This could involve stealing funds, minting worthless tokens, or granting the attacker control over the victim's assets.
6. Obfuscation:
   1. The phishing website might display fake transaction confirmations or account balances to delay the discovery of the theft.
   2. Meanwhile, the smart contract might use techniques like flash loans or multiple contract interactions to quickly move or launder stolen funds.
7. Propagation:
   1. Successful attacks might be used to fund more sophisticated phishing campaigns or develop more complex malicious smart contracts.

This synergy between phishing contracts and websites demonstrates why a combined approach to threat intelligence is crucial. The first company's database of risky smart contracts could flag the malicious contract, while the second company's domain intelligence could identify the associated phishing website. Together, they could provide a complete picture of the threat, potentially preventing users from falling victim to such schemes.

‍

By correlating data from different sources, the partnership could also:

‍

• Identify patterns in how phishing contracts and websites are typically structured
• Track the evolution of these threats over time
• Provide early warning systems for new phishing campaigns that use similar tactics

This holistic approach would be far more effective in combating crypto-related fraud than focusing on either on-chain or off-chain threats in isolation.

‍

Deployer Risk

‍

Monitoring the reputation of smart contract deployers is an added value offered by Trugard. This further level of detail delivers insights and benefits to the cryptocurrency ecosystem by in essence enabling a deployer “reputation”. Let's explore this in more detail:

‍

1. Historical Performance Tracking:
   1. By monitoring deployers, you can build a track record of their past contracts.
   2. This allows for identification of developers or entities with a history of creating vulnerable or malicious contracts.
2. Risk Assessment:
   1. New contracts from deployers with poor reputations can be flagged for extra scrutiny.
   2. Users and investors can make more informed decisions about interacting with contracts based on the deployer's reputation.
3. Accountability:
   1. Public reputation tracking encourages developers to prioritize security and best practices.
   2. It becomes harder for malicious actors to repeatedly deploy harmful contracts without consequences.
4. Early Warning System:
   1. If a previously reputable deployer suddenly releases a suspicious contract, it could indicate a compromised account or a shift in intentions.
   2. This can serve as an early warning for potential threats.
5. Trust Building:
   1. Developers and projects with consistently good reputations can build trust in the community.
   2. This can lead to increased adoption and investment in their protocols.
6. Ecosystem Health:
   1. By discouraging bad actors and promoting good practices, the overall health and security of the blockchain ecosystem improves.
7. Regulatory Compliance:
   1. In an increasingly regulated space, tracking deployer reputations can assist in due diligence processes.
   2. It can help identify potential links to illicit activities or sanctioned entities.
8. Pattern Recognition:
   1. Analyzing deployer behavior over time can reveal patterns associated with legitimate vs. malicious activities.
   2. This data can be used to develop more sophisticated threat detection models.
9. Community Contributions:
   1. Reputation systems could incorporate community feedback, allowing users to report suspicious activities.
   2. This crowdsourced approach can enhance the accuracy and timeliness of reputation assessments.
10. Cross-Chain Intelligence:
    1. Tracking deployer reputations across multiple blockchains can provide insights into cross-chain attack patterns.
    2. It can help identify when malicious actors migrate their operations to new chains.
11. Collaboration Opportunities:
    1. Reputable developers might find more opportunities for collaboration and funding.
    2. Projects may use deployer reputations as part of their vetting process for partnerships or integrations.
12. Education and Improvement:
    1. Developers can learn from the mistakes and successes of others based on reputation data.
    2. This can lead to overall improvement in smart contract development practices.

By incorporating deployer reputation monitoring into FYEO’s and Trugard’s joint offering, customers are armed with an even more comprehensive risk assessment tool. This solution not only helps in identifying current threats but also in predicting and preventing future ones. It adds another layer of context to the analysis of smart contracts and associated web domains, making the combined intelligence even more powerful and actionable.

‍

Tying it all together

Drawing a connection between a high-risk smart contract deployer and the operator of a phishing domain is a key aspect of comprehensive threat intelligence in the cryptocurrency space. This connection can reveal sophisticated attack patterns and provide valuable insights for security measures. Let's explore this relationship:

‍

1. Shared Infrastructure:
   1. A high-risk deployer might use the same or similar infrastructure to deploy smart contracts and host phishing domains.
   2. This could include using the same IP addresses, hosting providers, or domain registrars.
2. Financial Trails:
   1. Funds from compromised smart contracts might be funneled to wallets associated with phishing domain operators.
   2. Cryptocurrency used to pay for domain registrations or hosting services might be traced back to wallets linked to malicious smart contracts.
3. Timing Correlations:
   1. The deployment of high-risk smart contracts might coincide with the registration or activation of phishing domains.
   2. This temporal relationship could indicate a coordinated attack strategy.
4. Targeting Patterns:
   1. Both the smart contracts and phishing domains might target the same projects, tokens, or user groups.
   2. For example, a fake token contract might be deployed around the same time as a phishing domain imitating the token's official website.
5. Code Similarities:
   1. The code structure or specific functions in high-risk smart contracts might have similarities to scripts used on phishing websites.
   2. This could indicate the same individual or group is behind both the on-chain and off-chain components of the attack.
6. Communication Channels:
   1. Investigations might reveal shared communication channels (e.g., Telegram groups, Discord servers) used to coordinate both smart contract deployments and phishing campaigns.
7. Linguistic Analysis:
   1. The language used in smart contract comments or associated documentation might match the text on phishing websites.
   2. This could help identify attacks originating from the same threat actor.
8. Exploit Techniques:
   1. The methods used to exploit victims through smart contracts might align with the tactics employed on phishing sites.
   2. For instance, both might use similar social engineering techniques or exploit the same vulnerabilities in user behavior.
9. Wallet Addresses:
   1. The wallet addresses associated with high-risk deployers might be used in phishing scams or listed on phishing sites as "official" addresses.
   2. This direct link can strongly indicate a connection between the two threats.
10. Evolution of Tactics:
    1. Observing how a high-risk deployer's tactics change over time might predict shifts in associated phishing strategies, and vice versa.
    2. This could help in preemptively identifying new threats.
11. Geographic Data:
    1. If available, geographic data related to contract deployment and domain registration might show correlations.
    2. This could be particularly useful in identifying organized groups operating across multiple jurisdictions.
12. Victim Overlap:
    • Analyzing victim data might reveal that users who interacted with high-risk smart contracts are more likely to be targeted by specific phishing domains.

By connecting these dots, FYEO and Trugard offer customers the ability to:

‍

• Understand more comprehensive threat profiles that span both on-chain and off-chain activities.
• Leverage predictive models to anticipate new attack vectors based on observed connections.
• Receive more accurate risk assessments by considering the full spectrum of an attacker's capabilities.
• Take advantage of enhanced protection to users by warning them of potential threats across multiple platforms and mediums.

This holistic approach to threat intelligence would be far more effective than treating smart contract risks and phishing domains as separate issues. It recognizes the interconnected nature of crypto-related threats and allows for more robust security measures and user protection strategies.

‍

The future is connected. Learn more about a holistic security approach for your business in partnership with the Web3 Security Coalition.

‍